---
id: CVE-2026-74879
title: >-
  openssl_encrypt versions before 1.4.0 contain an information disclosure
  vulnerability in the /ready endpoint that returns full database exception
  strings to unauthenticated callers
summary: >-
  openssl_encrypt versions before 1.4.0 contain an information disclosure
  vulnerability in the /ready endpoint that returns full database exception
  strings to unauthenticated callers. Attackers can trigger database errors to
  extract sensit…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-209
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
patched:
  - openssl_encrypt 1.4.0
published: '2026-08-17'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:39.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74879'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-information-disclosure-via-ready-endpoint
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jahlives/openssl_encrypt/commit/7aa8787f4de2e9a23f58fca067bb16c4c69d28bb
  - url: 'https://github.com/jahlives/openssl_encrypt'
tags:
  - nvd
  - cve.org
  - osv
  - pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-17T15:44:41.768802Z'
epss: 0.00444
epssPercentile: 0.38758
aliases:
  - GHSA-2vhw-q7vh-7xv2
ecosystem: pip
ingestedAt: '2026-08-18T12:28:08.023Z'
---

## Overview

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Upgrade past the affected range:

- `openssl_encrypt 1.4.0`

## Package advisory (CVE-2026-74879)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/GHSA-2vhw-q7vh-7xv2